CVE-2026-40404

Analyzed Analyzed - Analysis Complete

UDFS Elevation of Privilege Vulnerability in Windows

Publication date: 2026-06-09

Last updated on: 2026-06-10

Assigner: Microsoft Corporation

Description

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-09

Last Modified

2026-06-10

Generated

2026-06-30

AI Q&A

2026-06-09

EPSS Evaluated

2026-06-28

NVD

CVE-2026-40404

EUVD

EUVD-2026-35656

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_server_2012	r2
microsoft	windows_server_2012	*
microsoft	windows_10_1607	to 10.0.14393.9234 (exc)
microsoft	windows_10_1607	to 10.0.14393.9234 (exc)
microsoft	windows_10_1809	to 10.0.17763.8880 (exc)
microsoft	windows_10_1809	to 10.0.17763.8880 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7417 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7417 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7417 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7417 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7417 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7417 (exc)
microsoft	windows_11_23h2	to 10.0.22631.7219 (exc)
microsoft	windows_11_23h2	to 10.0.22631.7219 (exc)
microsoft	windows_11_24h2	to 10.0.26100.8655 (exc)
microsoft	windows_11_24h2	to 10.0.26100.8655 (exc)
microsoft	windows_11_25h2	to 10.0.26200.8655 (exc)
microsoft	windows_11_25h2	to 10.0.26200.8655 (exc)
microsoft	windows_11_26h1	to 10.0.28000.2269 (exc)
microsoft	windows_11_26h1	to 10.0.28000.2269 (exc)
microsoft	windows_server_2016	to 10.0.14393.9234 (exc)
microsoft	windows_server_2019	to 10.0.17763.8880 (exc)
microsoft	windows_server_2022	to 10.0.20348.5256 (exc)
microsoft	windows_server_2025	to 10.0.26100.32995 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-197	Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

CVE-2026-40404 is an elevation of privilege vulnerability in the Windows Universal Disk Format File System Driver (UDFS). This means that an attacker who successfully exploits this vulnerability could gain higher privileges on the affected system than they are normally allowed.

Impact Analysis

This vulnerability can allow an attacker to elevate their privileges on a Windows system, potentially gaining unauthorized access to sensitive information or the ability to execute actions that require higher permissions. The CVSS base score of 7.8 indicates a high severity with impacts on confidentiality, integrity, and availability.

Compliance Impact

This vulnerability allows elevation of privilege, which can lead to unauthorized access or control over affected systems.

Such unauthorized access or control can potentially result in breaches of sensitive data, thereby impacting compliance with data protection standards and regulations like GDPR and HIPAA.

However, specific details on compliance impact are not provided in the available resources.

Mitigation Strategies

The vulnerability CVE-2026-40404 is an Elevation of Privilege issue affecting the Windows Universal Disk Format File System Driver.

To mitigate this vulnerability, it is recommended to apply the security updates provided by Microsoft as soon as possible.

Refer to the official Microsoft security update guide for CVE-2026-40404 to obtain and install the necessary patches.

Hi! I’m here to help you understand CVE-2026-40404. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70